CVE-2021-32796

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-116CWE-91

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-327979.6JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusteCVE-2021-327989.6The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute codeCVE-2021-328008.1Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor AuthenticationCVE-2021-328015.5Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging poteCVE-2021-328029.8Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. CVE-2021-328038.1The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability CVE-2021-328048.1The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability dCVE-2021-328056.1Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an atCVE-2021-328066.1Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open ReCVE-2021-328077.2The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is anCVE-2021-328085.4ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget pluginCVE-2021-328095.4ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipb
CVE-2021-32796: Medium severity, CVSS 5.3 | Vulnix